What are the potential pitfalls of not properly escaping user input in SQL queries in PHP?

Not properly escaping user input in SQL queries in PHP can lead to SQL injection attacks, where malicious users can manipulate queries to access or modify data in unintended ways. To prevent this, always escape user input using prepared statements or parameterized queries with placeholders to ensure that input is treated as data and not executable code. 

// Example of using prepared statements to safely handle user input in SQL queries
$pdo = new PDO('mysql:host=localhost;dbname=mydatabase', 'username', 'password');

$user_input = $_POST['user_input'];

$stmt = $pdo->prepare('SELECT * FROM users WHERE username = :username');
$stmt->bindParam(':username', $user_input);
$stmt->execute();

$results = $stmt->fetchAll();
foreach ($results as $row) {
    echo $row['username'] . '<br>';
}

Keywords

SQL injection user input escaping security vulnerability PHP functions

Related Questions